froxlor security release 2.3.17

• [Security] nginx served php files as plain text in folders with directory options
• [Security] nginx directory protection did not cover php, regex locations and subfolders
• [Security] fully resolve symlinks when validating customer paths (GHSA-jpg6-j246-v2jh)
• [Security] enforce 0600 on lib/userdata.inc.php
• [Security] validate ssl/tls cipher lists that end up verbatim in webserver configs
• [Security] require change_serversettings for SysLog.delete
• [Security] honor customer_hide_options in global search and parent 'extras' for logger
• [Security] validate hsts_maxage as integer and DirProtections username/authname with /D
• [Security] scope ftp_domain, jqGetCustomerPHPConfigs and reseller ip-restriction checks correctly
• [Security] stage customer data exports in a root-owned folder outside the customer docroot
• [Security] reject alias-target domains not owned by the target customer in Domains.add
• [Fix] disable sorting of cronjob description and interval columns, sql sorts language-key/text instead of displayed value; fixes #1432
• update SECURITY.md (outdated mentions of 'huntr' platform)
• [Fix] validate logger.logfile as plain filename, it is always written to froxlor/logs/
• [Security] require change_serversettings for web-update and db-update pages
• [Security] write userdata.inc.php strings as escaped literals instead of nowdoc
• [Security] stop mounting Vue on the page (client-side template injection)
• nginx: fix perl_server settings-groups
• [Security] validate more settings that end up in root-run commands/configs
• [Security] validate *httpgroup settings and escape chown owner-spec
• [Security] harden mkDirWithCorrectOwnership against symlink swap races
• [Security] enforce customer_hide_options on remaining API gaps
• [Security] honor customer_hide_options 'extras.logger' in SysLog API
• [Fix] group the user condition of a reseller's system log queries (#1433)

Full Changelog: 2.3.16...2.3.17